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Fourth report of the Organization for the Prohibition 
of Chemical Weapons-United Nations Joint 
Investigative Mechanism 

I. Introduction 

1. The present report is the fourth report of the Organization for the Prohibition 
of Chemical Weapons (OPCW)-United Nations Joint Investigative Mechanism 
pursuant to Security Council resolution 2235 (2015). It covers the period from 
20 August 2016, when the Mechanism’s third report (S/2016/738/Rev. 1) was 
submitted to the Security Council, to 19 October 2016. 


II. Background 

2. The Mechanism was established with a mandate to identify to the greatest 
extent feasible individuals, entities, groups or Governments who were perpetrators, 
organizers, sponsors or otherwise involved in the use of chemicals as weapons, 
including chlorine or any other toxic chemical, in the Syrian Arab Republic where 
the OPCW fact-finding mission determined or had determined that a specific 
incident in the Syrian Arab Republic had involved or had likely involved the use of 
chemicals as weapons. 

3. The Mechanism began its activities with the appointment of the Leadership 
Panel on 24 September 2015. In accordance with paragraphs 6 and 9 of Security 
Council resolution 2235 (2015), various agreements were concluded concerning the 
work of the Mechanism, including with OPCW and the Syrian Arab Republic. 
Pursuant to paragraph 10 of the resolution, the Secretary-General, in his letter dated 
9 November addressed to the President of the Security Council (S/2015/854), 
informed the Council that the Mechanism would begin its full operations on 
13 November. 

4. The Mechanism’s mandate was implemented in two phases. The first, 
pertaining to information collection and planning for case development, consisted of 
reviewing and analysing the mission’s data, mapping the incidents and developing 
an investigation plan and methodology. The Mechanism also began to collect 
information and evidence not obtained or prepared by the mission that was deemed 
to be relevant to its mandate (non-mission sources), including information from the 
Government of the Syrian Arab Republic and all parties in the Syrian Arab 
Republic, other Member States, individual groups and entities and open sources. At 
the end of the first phase, the Mechanism informed the Security Council of the 
following nine cases of use of chemicals as weapons in the Syrian Arab Republic to 
be investigated: 

(a) Kafr Zita, Hama governorate, 11 April 2014; 

(b) Kafr Zita, Hama governorate, 18 April 2014; 

(c) Talmenes, Idlib governorate, 21 April 2014; 

(d) Al-Tamanah, Idlib governorate, 29 and 30 April 2014; 
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(e) Al-Tamanah, Idlib governorate, 25 and 26 May 2014; 

(f) Qmenas, Idlib governorate, 16 March 2015; 

(g) Sarmin, Idlib governorate, 16 March 2015; 

(h) Binnish, Idlib governorate, 24 March 2015; 

(i) Marea, Aleppo governorate, 21 August 2015. 

5. Following the identification of those nine cases, the Mechanism began its 
second phase (case investigation), which consisted of in-depth analysis of the cases 
and continued until sufficient relevant information had been gathered, analysed, 
assessed and corroborated to allow it to present its findings to the Security Council. 

6. The Mechanism was not mandated to act and function as a judicial or quasi¬ 
judicial body. Moreover, it has no authority or jurisdiction, whether directly or 
indirectly, to make a formal or binding judicial determination of criminal liability. 
The Mechanism functioned as a non-judicial investigative body within its mandate, 
identifying “to the greatest extent feasible” individuals and other actors involved in 
the use of chemicals as weapons and the roles that they played. It accordingly 
developed its own standards, as indicated in annex 1 to its third report. 

7. The Leadership Panel decided that, in reporting its findings to the Security 
Council, a sufficient degree of supporting evidence was required — that is, there is 
evidence of a credible and reliable nature to determine that a party was involved in 
the use of chemicals as weapons in the Syrian Arab Republic (see also S/2016/142, 
enclosure, sect. Ill, and S/2016/73 8/Rev. 1, annex I). 

8. The Leadership Panel, to implement a systematic approach in making the 
assessments, decided on key elements that the investigation would seek to establish 
for each case: (a) date and time; (b) weather conditions; (c) impact location; 
(d) munition (e.g., remnants); (e) delivery method (e.g., means and direction); 

(f) damage and effects (e.g., on buildings, the environment, flora and fauna); and 

(g) medical effects. The Mechanism aimed to corroborate all information and, as 
necessary, information was subjected to a separate analytical process, including 
through forensic analysis. In those cases in which key elements could be established 
consistently, the Panel reached a conclusion on the actors involved. 

9. During the investigation, the Mechanism reviewed and analysed the fact¬ 
finding mission information, in addition to the information and material that it had 
collected. This included more than 8,500 pages of documents, transcripts of more 
than 200 interviews, over 950 pieces of photographic material, more than 450 videos 
obtained from open sources and provided by witnesses, approximately 330 pages of 
forensic analysis and 3,500 multimedia files. The most pertinent material was, after 
initial analysis by the Mechanism, further analysed by four internationally 
recognized forensic and defence institutes. 

10. On this basis and as reflected in its third report, the Leadership Panel 
determined that there was sufficient information on three cases investigated to reach 
a conclusion as to the actors involved. The cases were Talmenes (21 April 2014), 
Sarmin (16 March 2015) and Marea (21 August 2015). Furthermore, the information 
and evidence collected in relation to three other cases investigated were deemed not 
to reach the level of sufficiency required for the Panel to reach a conclusion as to 
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the actors involved. The cases were Kafr Zita (11 April 2014) and Al-Tamanah 
(29 and 30 April and 25 and 26 May 2014). 


III. Assessments, findings and conclusions 

11. At the time of submission of its third report, information and evidence on the 
remaining three cases — Kafr Zita (18 April 2014), Qmenas (16 March 2015) and 
Binnish (24 March 2015) — were still being analysed by forensic laboratories. 

12. In relation to those cases, the Mechanism received and analysed additional 
information, including the results of forensic analysis that had been requested 
before the submission of its third report. It had also carried out interviews that had 
not been analysed at the time of submission of that report. 

13. The Leadership Panel outlined in the Mechanism’s third report common 
elements relating to the use of chlorine or a chlorine derivative as a weapon, to be 
read in conjunction with the specific findings. It also outlined some of the 
challenges of the investigation, such as that the incidents investigated occurred 
more than two years ago, between April 2014 and August 2015, that the Mechanism 
could not undertake field visits owing to the security situation on the ground and 
that it was investigating the use of a toxic chemical that was widely available in the 
Syrian Arab Republic. 

14. Taking these common elements into account and having analysed additional 
information received, the Leadership Panel arrived at the findings, assessments and 
conclusions set out below. 

Kafr Zita, Hama governorate, 18 April 2014 

15. The Leadership Panel, having examined the information and evidence 
regarding the incident in Kafr Zita on 18 April 2014, previously determined that the 
Syrian Arab Armed Forces had executed air strikes in that area on that day. The 
Panel could not, however, confirm the use of barrel bombs because the remnants of 
the device allegedly used had been removed and could not be linked with certainty 
to impact location No. 2, previously identified in annex III to the third report. 

16. The Leadership Panel, having reviewed all the information obtained during the 
reporting period, could not provide further clarity on the remnants of the device and 
its possible connection to impact location No. 2, nor could it reach a conclusion as 
to whether the toxic chemicals had been released as a result of the use by the Syrian 
Arab Armed Forces of a conventional weapon or weapons that had interacted with 
toxic chemicals on the ground or whether the munition itself had contained toxic 
chemicals. 

17. Accordingly, the Leadership Panel determines that the status of this case 
remains unchanged. 

Qmenas, Idlib governorate, 16 March 2015 

18. The Leadership Panel, having examined the information regarding the incident 
in Qmenas on 16 March 2015, previously determined that a Syrian Arab Armed 
Forces helicopter had dropped a barrel bomb or other device at impact location 
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No. 1 in Qmenas, identified in annex VII to the third report. Although the Panel was 
close to having sufficient information to reach a conclusion on the actors involved 
at the time of submission of the third report, it could not confirm whether the device 
used had contained explosives or chlorine. 

19. The Leadership Panel determines that there is now sufficient information to 
conclude that the incident at impact location No. 1 was caused by a Syrian Arab 
Armed Forces helicopter dropping a device from high altitude, which hit the ground 
and released the toxic substance that affected the population. 

20. This conclusion is based on the following additional assessments: 

• Two witnesses, who indicated having been a short distance away from location 
No. 1 at the time of the impact, reported a foul or strong odour that emerged 
immediately after the impact of a device that had been dropped from a 
helicopter. The witnesses also reported eye and skin irritation, a feeling of 
suffocation and coughing. 

• This testimony was consistent with information concerning the patients who 
arrived on the evening of 16 March 2015 in the Sarmin hospital from Qmenas 
showing symptoms relating to chlorine exposure. They also reported that the 
clothes of those who arrived at the hospital smelled of chlorine. 

• Witnesses who visited impact location No. 1 described the remnants and 
reported discolouration of vegetation at the location. The discolouration 
visible on the photographs taken at impact location No. 1 was confirmed by 
forensic analysis. Furthermore, a vegetation index analysis using satellite 
pictures showed a patch of less healthy vegetation at that location. 

• In addition to the witness statements and information from other sources 
regarding a helicopter flying over Qmenas at the time of the incident, analysis 
by a defence research institute of the photographs showing the remnants and 
the impact location found that the crater was likely to have been caused by a 
device dropped from a high altitude, possibly more than 1,000 m, on to a hard 
surface. Such a flight would have been in the coverage area of the Syrian Arab 
Armed Forces radar. 

• The Leadership Panel reiterates that, having reviewed all the information 
gathered, it found no evidence that armed opposition groups in Qmenas had 
been operating a helicopter at the time and location of the incident. 

Binnish, Idlib governorate, 24 March 2015 

21. The Leadership Panel, having examined the information regarding the incident 
in Binnish on 24 March 2015, previously confirmed the existence of a canister with 
traces of chlorine or a chlorine-like substance. At the time of submission of the third 
report, the Mechanism was awaiting information and the forensic analysis of material 
received in order to clarify certain inconsistencies in the information before it. 

22. The Leadership Panel reviewed and analysed additional information and the 
results of forensic analysis, including metadata of media files, and determined that 
the inconsistencies previously identified were due to the existence of more than one 
event occurring in close sequence from 23 to 25 March 2015. The events included 
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repeated Syrian air force overflights and air strikes on Binnish during the battle for 
Idlib in March 2015. 

23. Additional witness statements and image analysis corroborated that a canister 
with traces of chlorine had been found in Binnish. The exact time and location could 
not be established, however. The canister could also not be linked to any of several 
incident locations identified: 

• Forensic analysis of a photograph showing a smoke plume concluded that the 
plume was located at the coordinates N35.955286° E36.717797°, previously 
identified as impact location No. 1 (see annex IX to the third report). The 
plume is assessed to have resulted from an air strike with explosives, which 
most likely occurred during the afternoon of 25 March 2015. 

• As indicated in annex IX to the third report, impact location No. 2 could not 
be established. 

• Another location. No. 3, was identified. It is some 150 m from location No. 1. 
The following information was obtained about this location: 

• There were remnants of a barrel bomb consisting of intact canisters, a 
plastic bottle and an outer jacket. However, no crater could be observed. 

• Forensic analysis of photographs and satellite imagery of the location 
showed discolouration of vegetation and was consistent with witness 
statements about the state of the vegetation at the location. Forensic 
analysis also showed that the dispersion pattern seen through the 
discolouration of the vegetation pointed to toxic chemicals as the cause. 

• There was an impact location No. 4, located 180 m to the east of the location 
where the remnants were found. However, forensic analysis determined that 
impact location No. 4 was not linked to the remnants found at location No. 3. 

24. This additional information notwithstanding, inconsistencies remained. 
Accordingly, the Leadership Panel determines that the status of the case remains 
unchanged. 


IV. Summary of findings and overall comments regarding 
case assessments 

Summary of findings 

25. In the third report, the Leadership Panel reached a conclusion as to the actors 
involved in three of the nine cases investigated by the Mechanism: Talmenes 
(21 April 2014), Sarmin (16 March 2015) and Marea (21 August 2015). As 
discussed above, the Panel has also reached a conclusion as to the actors involved in 
the incident in Qmenas on 16 March 2015. 

26. The Leadership Panel determined in the third report that Islamic State in Iraq 
and the Levant (ISIL) had been involved in the use of sulfur mustard in Marea on 
21 August 2015. The Panel concluded that ISIL had conducted an attack on Marea 
using several artillery shells filled with sulfur mustard, a chemical weapon. 
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27. The Leadership Panel also determined, in the third report and in section III 
above, that the Syrian Arab Armed Forces had been involved in the use of toxic 
chemicals as weapons in three cases: Talmenes (21 April 2014), Qmenas (16 March 
2015) and Sarmin (16 March 2015). Their helicopters were used to drop barrel 
bombs in those three cases. 

28. During the period in which the incidents under investigation occurred, the 
Syrian Arab Armed Forces possessed a fleet of rotary-wing aircraft, including 
transport and combat helicopters, used by the air force and the navy. Furthermore, 
the Mechanism obtained information that those helicopters could also be accessed by 
Syrian special forces. The information gathered by the Mechanism further indicated 
that, in addition to the relocation of air assets owing to the loss of some of the 
airbases to armed opposition groups, there were constant movements of helicopters 
from one airbase to another, based on operational needs, in particular of operations 
on the ground. Air assets have been known to undertake missions from airbases that 
were not necessarily their permanent base. 

29. The helicopter flights in the three cases originated from two government - 
controlled airbases, as follows: 

• Hama airbase, Hama governorate. In the case of Talmenes, the information 
assessed by the Panel indicates that a helicopter departed from Hama airbase, 
flew over Talmenes at the time of the incident and dropped a barrel bomb, as 
indicated in annex IV to the third report. 

• Humaymim airbase at Bassel al-Assad International Airport, Ladhiqiyah 
governorate. In the cases of Qmenas and Sarmin, information assessed by the 
Panel indicates that two consecutive helicopters, with pilots using call signs 
beginning with “Bravo”, departed from this airbase, flew over Qmenas and 
Sarmin, respectively, at the times of the incidents and dropped barrel bombs, as 
indicated in annexes VII and VIII to the third report. 

30. The 253 and 255 squadrons, both belonging to the Sixty-third Helicopter 
Brigade, which were formerly based at Taftanaz, were relocated to the Hama and 
Humaymim airbases. In addition, the 618 squadron, with navy helicopters, was 
based at the Humaymim airbase. 

31. On 10 October 2016, the Leadership Panel received from the Syrian Arab 
Republic extensive comments (S/2016/844) on its third report. The Panel notes with 
interest that the communication contains a reference to an internal investigation 
being carried out by the Syrian national committee. According to the communication, 
the committee conducted a thorough study (technical and legal) and reviewed the 
flight plans and air operations in some of the areas under investigation by the 
Mechanism, specifically referring to the Hama and Humaymim airbases. 

32. This is of particular interest because the Mechanism was previously informed 
that no such flight plans and information relating to air operations existed. Having 
been informed of the internal investigation, the Leadership Panel has again formally 
requested the Government to provide the names of the specific Syrian Arab Armed 
Forces units and any entity outside the Armed Forces from whom the national 
committee received the flight plans and information relating to air operations. A 
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reply to this request has not yet been received. Such information is of great 
importance, given that commanders are responsible for any assets under their control. 

33. Most of the helicopter assets at the Hama and Humaymim airbases at the time 
of the incidents belonged to the Sixty-third Helicopter Brigade. The Mechanism 
collected information on the Syrian Arab Armed Forces command structure. The 
Leadership Panel could not, however, confirm the names of the individuals who had 
command and control of the helicopter squadrons at the time. 

34. In five other cases — Kafr Zita (11 and 18 April 2014), Al-Tamanah (29 and 
30 April and 25 and 26 May 2014) and Binnish (24 March 2015) — the Leadership 
Panel assessed, in the third report and in section III above, that the information 
obtained and analysed did not allow for the identification of actors involved owing 
to inconsistencies that could not be resolved. 

Overall comments regarding case assessments 

35. The Leadership Panel, pursuant to paragraphs 5, 7 and 8 of Security Council 
resolution 2235 (2015), requested and collected information from all its sources, 
including on the prevailing situation at the time of the cases investigated and the 
infrastructure, organizational structure and assets of the Government, armed 
opposition groups and terrorist groups 1 that would assist the Panel’s assessments. 
This information was requested, in particular for Hama, Idlib and Aleppo 
governorates, for the period between March 2014 and August 2015. 

36. The Mechanism requested the Government of the Syrian Arab Republic to 
supply information concerning its armed forces, more specifically: 

(a) The command and organizational structure of the Syrian Arab Armed 
Forces, including the air force and the army; 

(b) Operations undertaken by the Syrian Arab Armed Forces on the dates and 
times and at the locations of the incidents under investigation, including information 
on the reporting of operations; 

(c) The location of its forces on the dates under investigation; 

(d) The status of the military bases and assets on the dates of the incidents 
investigated, as well as aircraft and ammunition seized by terrorist groups and 
armed opposition groups from bases no longer controlled by the Government, and 
how the military assets from those bases were relocated; 

(e) Documents such as rules of engagement, military doctrine, flight logs, 
situation reports and pre-mission and post-mission assessments and memorandums. 

37. The Government provided information on, among other things, general air and 
ground operations at or near the locations investigated on the dates of the incidents, 
in addition to information on the status of military bases and assets, including those 
that it no longer controlled. In relation to the Taftanaz (Idlib governorate) and Jarrah 
(Aleppo governorate) airbases, both of which were not under government control at 
the time of the incidents, the Government provided a detailed list of equipment and 


1 On 30 May 2013, ISIL and the Nusrah Front were designated as terrorist groups by the Security 
Council under resolution 1267 (1999). 
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other assets lost, including operational and non-operational aircraft and consumables 
such as fuel, together with a list of missing and defected officers. Some of this 
information was included in the Mechanism’s third report, in particular the annexes. 
Citing national security concerns, the Government did not provide information on the 
command and organizational structure of the Syrian Arab Armed Forces or the order 
ofbattle for its air force and army as it was in 2014 and 2015. 

38. In relation to the Syrian air force, the Government informed the Mechanism 
that its helicopter fleet undertook various missions, such as transporting payloads 
and ordnance, rescuing and transporting injured persons, providing air support to 
the operations of ground forces, engaging in combat operations and conducting 
reconnaissance. The missions were undertaken when the air force received requests 
from many different sources, including the army and civilians. No detailed planning 
was undertaken before such support missions, which were executed immediately. In 
this regard, although pre-mission and post-mission assessments existed before the 
conflict, no longer were there situation reports or post-operation memorandums. 
Only a verbal post-mission evaluation and assessment was provided by the pilot to 
the direct commander. Documentation was prepared only in the event of damage to 
aircraft, as well as when transporting injured victims or dropping humanitarian aid, 
pursuant to a decision of the airbase commander or the immediate commander. 

39. The Government informed the Mechanism that the army had situation reports 
on ground operations of significance, such as instances of material losses or 
injuries. The army stated that it used only conventional weapons and provided 
information on its doctrine on procedures for protection against toxic chemicals. It 
confirmed that it had no separate fleet of helicopters and did not keep an updated 
inventory of its ammunition, although it did record losses in the situation reports. 

40. The Mechanism also requested the Government to arrange meetings with those 
army, air force and air force intelligence commanders, as well as the commanders of 
the Hama and Humaymim airbases, serving at the time of the incident. The 
Government was unable to arrange for the Mechanism to meet the commanders. It 
did, however, make available two generals, one from the army and one from the air 
force, who provided broad responses on the existing procedures in their respective 
forces. 

41. As indicated in the third report, in a number of cases investigated by the 
Mechanism, the Government informed the Mechanism that “terrorist groups” had 
had possession of and transported toxic chemicals, including chlorine, for use as 
weapons. The Government also informed the Mechanism that its armed forces, in 
some cases, had targeted locations in which those groups were storing toxic 
chemicals. In that connection, the Mechanism requested further information and 
clarity from the Government, in particular with regard to the alleged possession, 
transportation and storage of toxic chemicals by the groups. The Government did 
not provide further information, citing national security concerns. 
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V. Other issues 

Information management 

42. The Leadership Panel previously reported that the Mechanism had implemented 
a records management system within a robust information security regime to ensure 
appropriate protection for the information in its possession. This system is set out in 
full in the annex to the present report. It includes the type and classification of 
information held by the Mechanism and its content and records management system. 
The information and evidence collected by the Mechanism is being prepared for 
submission to the Secretary-General for storage and archival preservation. 

Offices 

43. The Mechanism closed its office in The Hague on 23 September 2016, given 
that the investigations into the three cases had been completed by that date. The 
extension period was used for the completion of its report, including a review and 
analysis of the information material and the Leadership Panel’s assessment, at the 
New York office. The Mechanism also closed its liaison office in Damascus, 
maintaining exchanges with the Government of the Syrian Arab Republic through 
the office in New York via the Permanent Mission of the Syrian Arab Republic to 
the United Nations. 

Staffing 

44. At its full capacity, the Mechanism’s core staff, including the Leadership 
Panel, the Chief of Staff and the head of the Mechanism’s office in The Hague, 
consisted of 22 Professional staff from 16 countries. It also had seven consultants, 
including translators. 

Voluntary contributions 

45. The Mechanism received voluntary contributions from 12 Member States in 
support of its activities. 


VI. Concluding remarks 

46. As indicated in its third report, the Mechanism, in line with its authority under 
resolution 2235 (2015), relied on the voluntary submission of information. Thus, the 
Mechanism was as strong as the information that it was able to collect and 
corroborate. 

47. Within the time frame allotted, the Leadership Panel identified the actors 
involved to the greatest extent feasible in four of the nine cases that it investigated. 

48. In June 2016, the Mechanism, in its second report (S/2016/530), informed the 
Security Council of its volume of work and gave an indication as to the time 
required to investigate the various layers of perpetration, in addition to finding 
sponsors, organizers and those otherwise involved. 

49. The Leadership Panel reiterates that alternative information collection efforts 
and investigative skills would be required to understand and establish the link 
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between the actors identified by the Panel and the individual perpetrators and their 
chain of command, as well as sponsors and organizers. 

50. As reflected in its third report, the Mechanism requested information 
concerning the production, possession and movement of chlorine by the 
Government of the Syrian Arab Republic. It also looked into the possession and 
movement of chlorine by terrorist groups, in particular the Nusrah Front, and armed 
opposition groups, given that a major chlorine production facility had been taken 
over by the Nusrah Front in August 2012. 

51. The Leadership Panel notes with grave concern that, during the reporting 
period, the Mechanism received 13 allegations of possession, movement and/or 
intent of use of toxic substances, including chemical weapons, by non-State actors 
in the Syrian Arab Republic. They were referred to the OPCW technical secretariat. 

52. The Leadership Panel reiterates once again its strong conviction that the use of 
chemicals as weapons, for any reason and under any circumstances, is totally 
abhorrent. The Panel also reaffirms its belief that it is crucial to hold those who use 
or intend to use chemicals as weapons accountable for their acts, given that it is 
fundamental to deter all those who continue to believe that there is something to be 
gained from the use of toxic chemicals as weapons. No reason can justify their use 
or intent of use as weapons by anybody, anywhere. If individuals, groups, entities or 
Governments perceive these weapons to be useful tools, no matter the costs, 
proliferation will ensue. The Panel therefore believes that those with effective 
control in the military units referred to in paragraph 30 of the present report must be 
held accountable. Accountability must also be applied to others responsible for the 
use of chemicals as weapons in the Syrian Arab Republic. 

53. The Leadership Panel conveys its appreciation for the cooperation received 
from Member States and other entities in support of its work to date, including the 
generous financial contributions received. 

54. Lastly, the Leadership Panel expresses its appreciation for the support received 
from the United Nations Secretariat, in particular the Office for Disarmament 
Affairs, and from the OPCW technical secretariat in delivering its mandate. 
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Annex 


Information management by the Organization for the 
Prohibition of Chemical Weapons-United Nations Joint 
Investigative Mechanism 

1. The Organization for the Prohibition of Chemical Weapons-United Nations 
Joint Investigative Mechanism, in accordance with the letter dated 27 August 2015 
from the Secretary-General addressed to the President of the Security Council 
(S/2015/669) containing the elements of the terms of reference of the Mechanism, 
safeguarded its documents and evidence to ensure the integrity and confidentiality 
of its work. To this end, the Mechanism developed and implemented a records 
management system within a robust information security regime applied to all the 
information that it obtained or generated in the conduct of its work. In setting up the 
regime, confidentiality and security requirements deemed necessary for the storage 
and use of the information material provided to the Mechanism by the Organization 
for the Prohibition of Chemical Weapons (OPCW) fact-finding mission were taken 
into account. Access to confidential information was on a need-to-know basis. 

2. The Mechanism concluded a memorandum of understanding with OPCW on 
26 November 2015 concerning the provision of access, storage and handling of 
information. All personnel were required to enter into individual confidentiality 
undertakings. In addition, the Mechanism conducted its work in accordance with the 
Secretary-General’s bulletin on information sensitivity, classification and handling 
(ST/SGB/2007/6) and the relevant sections of the Secretary-General’s bulletin on 
record-keeping and the management of United Nations archives (ST/SGB/2007/5), 
concerning the creation, management and disposition of records. 

Standard operating procedure on information management 

3. The Mechanism, in consultation with the Archives and Records Management 
Section of the Department of Management, developed and implemented a standard 
operating procedure for information management. All personnel were required to 
follow the information-handling instructions contained therein. The effective 
handling of information was seen as central to the Mechanism’s ability to fulfil its 
mandate as it would assist in ensuring the safety and security of the Mechanism’s 
activities, personnel and third parties, strengthening the integrity of its records and 
evidence, better supporting timely information retrieval, analysis and dissemination 
and encouraging a culture of confidentiality and promoting the correct handling of 
records and evidence. 

4. The standard operating procedure covered all information material, including 
records and evidence generated, received and handled by the Mechanism. Special 
emphasis was laid on material classified as confidential and strictly confidential. 

5. The standard operating procedure outlined measures relating to office and 
physical security to protect the information material stored and handled by the 
Mechanism. It further detailed the Mechanism’s registry, the central repository for its 
records, including procedures for access, based on roles and responsibilities, to its 
contents. It highlighted the importance of preserving the chain of custody for 
evidence in its possession, in particular the maintenance of the evidence audit trail. It 
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also covered subjects relating to electronic records, such as creating, reproducing, 
scanning, transmitting and sharing records, using external storage devices and cloud - 
sharing platforms, using e-mail and shared drives and having a clean-desk policy. 

6. One portion of the standard operating procedure was dedicated to evidence 
storage and handling procedures. It referred to the appointment of an evidence 
custodian and securing evidence through the use of evidence vaults and containers 
meeting environmental and security requirements. It also outlined the procedures for 
personnel to follow when deployed to the field and procedures upon return, in 
particular the registration of evidence collected. Furthermore, detailed procedures 
were outlined for transporting records and evidence. 

Types and classification of information held by the Mechanism 

7. The information held by the Mechanism was divided into three security 
classifications: unclassified, confidential and strictly confidential. 

8. The following types of records were classified as strictly confidential or 
confidential: 

(a) Correspondence and information received from Member States; 

(b) Witness statements; 

(c) Material received from witnesses or through third parties; 

(d) Information received from OPCW, including information and evidence 
obtained by the fact-finding mission; 

(e) Reports from forensic and defence institutes, including forensic and 
defence analysis; 

(f) Information received from external bodies on a confidential basis; 

(g) Satellite imagery and analysis; 

(h) Internal working documents of the Mechanism, including investigation 
plans, case files, analysis, assessments and minutes of meetings; 

(i) Administrative, personnel and financial records. 

9. Unclassified information mainly consists of open-source material collected by 
the Mechanism and other publicly available material. 

Content and records management system 

10. The information held by the Mechanism is in three types of media: electronic 
records; certified copies of records of the fact-finding mechanism; and physical 
records, such as paper, compact discs, digital videodiscs, secure digital cards and 
other storage devices. 

Unite Docs 

11. The Mechanism established an enterprise content management system through 
the use of an internal web-based platform called “Unite Docs”, which was 
customized for document creation, sharing and storage. The use of that system 
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allowed for records management capabilities through a seamless integration with a 
records management system. It also allowed for secure collaboration between the 
offices in New York and The Hague by enabling secure access for all personnel to 
the documents stored using this platform. 

12. All electronic information collected or generated by the Mechanism was stored 
in Unite Docs, unless otherwise arranged or requested by the records originator. 

13. In the case of paper records, originals were scanned and uploaded to Unite 
Docs, unless otherwise requested by the records originator. Physical evidence not 
permitted to be scanned was entered in the system as “metadata only” (excluding 
information regarding the physical evidence that might compromise its 
confidentiality), in order for it to be registered and tracked in the system. 

14. Through the use of permission settings, access to confidential documents 
placed on Unite Docs by the Mechanism’s personnel was restricted as deemed 
appropriate by the Leadership Panel. In addition, the auditing and tracking of 
confidential material being read and written were enabled to keep a record of the 
personnel accessing and making changes to the material. Furthermore, no users 
except the records manager were permitted to delete records and evidence to ensure 
that no records of the Mechanism were deleted from the system and lost. 

15. Unite Docs was implemented in compliance with the United Nations policies 
on information security and certified for storage of strictly confidential material (the 
highest security classification in the United Nations) by the Global Security and 
Architecture Section of the Office of Information and Communications Technology. 
The system can be accessed only within the United Nations network and all 
information marked as confidential or above was encrypted in the file store 
(network-attached storage). 

16. The Mechanism’s personnel were trained in the use of the system and briefed 
about security and confidentiality measures taken to protect the information material. 

Air-gapped network (not connected to the Internet or to any other computer network) 

17. This isolated network was located in the office in The Hague and consisted of 
a dedicated server with two terminals used to consult material, which could not be 
copied or printed, placed on the file server. The terminals had no Wi-Fi cards and 
their universal serial bus ports were disabled. Logging capabilities kept records of 
who consulted the material and when. 

18. Material on the server included the forensic copies of the fact-finding mission 
information and evidence provided by OPCW, witness statements with identifiable 
names or information and other highly sensitive documents. 

Paper records 

19. A small quantity of material was available only in hard copy by request of the 
records originator. The originals are stored in New York and copies, if any, were 
numbered and tracked. The Mechanism’s investigators were able to review the 
paper material upon request and followed a chain of custody regime to ensure that 
access to the material was properly recorded. 




